Nodus Privacy Policy

Last updated: October 6, 2026

Nodus ("the app") is an email client for Android developed by Blurpx ("we", "us"). It lets you read and send email from your own accounts (Gmail, Outlook/Hotmail, Yahoo, iCloud and any IMAP/SMTP provider).

The short version: Nodus connects directly from your phone to your email provider. We run no servers that receive your email. We don't collect, store, sell or share your data, and the app has no analytics, advertising or tracking.

1. Data the app accesses

When you add an account, the app accesses:

• Account credentials: your email address and either an app password / account password, or an OAuth refresh token if you sign in with Google or Microsoft.
• Email content: messages, folders, attachments, sender and recipient addresses, and flags (read/unread) in the accounts you add, so you can read, search, organize and send mail.
• Device notification permission: to show new-mail notifications.

2. How data is used and stored

• Credentials and tokens are stored only on your device, in the Android Keystore-backed secure storage. They are never sent to us.
• Email content is fetched from your provider straight to your phone and kept in the app's memory while you use it. Attachments you open are saved temporarily on your device.
• Nodus sends data only to the mail servers of the accounts you add, over encrypted connections (TLS), and to the sign-in services described below.
• The app checks for new mail in the background about every 15 minutes (a limit set by Android) and shows a local notification. This check runs on your device and contacts only your mail provider.
• Backup is disabled for the app, so its data isn't copied to cloud backups.

3. Third-party services

• Google Sign-In (OAuth 2.0): if you add a Gmail or Google Workspace account, you authorize Nodus through Google. The app requests the scope https://mail.google.com/ (IMAP/SMTP access to read, send and delete mail) and your email address. Google handles your sign-in; see Google's Privacy Policy.
• Microsoft Sign-In (OAuth 2.0): if you add an Outlook, Hotmail or Microsoft 365 account, you authorize Nodus through Microsoft with the permissions IMAP.AccessAsUser.All and SMTP.Send. See Microsoft's Privacy Statement.
• Server auto-configuration: to find the right server settings for an address, the app looks up the email's domain in public sources (the domain's own autoconfiguration files, the Mozilla ISP database, and DNS MX records via public DNS-over-HTTPS resolvers such as Google Public DNS or Cloudflare). These requests contain the domain part of your address (for example example.com), not your full address, password or email content.
• Remote content in emails: emails may contain images or links hosted by third parties. Loading that content contacts those third parties, as in any email client. Links you tap open in your browser.

Nodus does not use analytics, advertising, crash-reporting or tracking services.

4. Google API Services User Data Policy (Limited Use)

Nodus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the user-facing email features of the app (reading, sending, organizing and deleting your mail).
• We do not transfer Google user data to anyone, except as needed to provide those features, to comply with the law, or as part of a merger or sale with your consent.
• We do not use Google user data for advertising, and we do not sell it.
• No humans read your data. Your email never reaches our systems.
• We do not use Google user data to develop, improve or train generalized AI or machine-learning models.

5. Sharing

We don't sell, rent or share your personal data. We don't receive it in the first place. Data leaves your device only to reach the mail provider you chose.

6. Retention and deletion

• Removing an account in the app ("Sign out of this account") deletes its credentials and tokens and cached data from your device.
• Uninstalling the app removes all of its data from your device.
• To revoke Nodus's access at the source, use your Google Account permissions or your Microsoft account permissions, or change your app password with your provider.
• Because we hold no copy of your data, there is nothing on our side to delete. Your emails remain with your provider under their policies.

7. Security

Credentials are kept in Android's secure storage, and all mail connections use TLS. If you turn on the "trust self-signed certificate" option for your own server, the app accepts that server's certificate without public verification; use it only for servers you control.

8. Children

Nodus isn't directed to children under 13, and we don't knowingly collect data from them.

9. Changes

We may update this policy. The date at the top shows the latest version, and material changes will be noted in the app's store listing or update notes.

10. Contact

Questions about this policy: nodus@sflashy.com Blurpx